In Theory And Practice, Why Internet-Based Voting Is a Bad Idea 218
A few countries, like Estonia, have gone for internet-based voting in national elections in a big way, and many others (like Ireland and Canada) have experimented with it. For Americans, with a presidential election approaching later this year, it's a timely issue: already, some states have come to allow at least certain forms of voting by internet. Proponents say online elections have compelling upsides, chief among them ease of participation. People who might not otherwise vote — in particular military personnel stationed abroad, but many others besides — are more and more reached by internet access. Online voting offers a way to keep the electoral process open to them. With online voting, too, there's no worry about conventional absentee ballots being lost or delayed in the postal system, either before reaching the voter or on the way back to be counted. The downsides, though, are daunting. According to RSA panelists David Jefferson and J. Alex Halderman, in fact, they're overwhelming. Speaking Thursday afternoon, the two laid out their case against e-voting.
(Read more for more, and look for a video interview with Halderman soon).
(Read more for more, and look for a video interview with Halderman soon).
Jefferson and Halderman have impressive credentials as analysts and critics of internet voting. Jefferson, a computer scientist at Lawrence Livermore National Laboratory, is chairman of the board of the Verified Voting Foundation, an NGO focused on promoting election integrity, and coauthor of a report that spurred the Department of Defense to withdraw for further consideration its then-plan for online voting, called SERVE, in 2004. Halderman takes a different, hands-on approach, demonstrating (along with his grad students at the University of Michigan) just how polling-station election machines and online voting system can be compromised. "I've probably hacked into and otherwise found vulnerabilities in more polling places than anyone else," he says.
Jefferson and Halderman are careful to define the key element of elections they're trying to expose as unfixably broken: namely, the delivery of completed ballots over the internet, whether that means a web app, email or some other conduit, without a voter-verified paper audit trail. Some kinds of election technology can move from the voting booth to the online world with less risk to the integrity of the election itself — for instance, distribution of blank ballots, or even online voter registration. "This isn't about keeping score of primaries, or gathering information about candidates, but actually voting," said Jefferson. The risk of hacked elections isn't just the possibility of political rivals trying to out-do each other, he said; ultimately, vulnerable election systems compromise national security and ballot secrecy. Even a few hundred votes may suffice to swing a House or Senate race, and that can have cascading consequences for control of elected bodies themselves. "Wherever there's a concentration of votes sufficient to swing a major election, there's a national security concern."
Why assume that election systems can be manipulated? And since paper ballots are not immune to questionable or downright fraudulent counts, why call out the electronic version in particular? In part, he says, because the structure of an electronic voting system is inherently complex, and because it's difficult if not impossible to roll back results if a compromise is suspected. Unlike paper ballots (and in the absence of a paper audit trail backing an electronic voting system), online vote gathering offers no good way to re-count. Jefferson laid out four major and overlapping areas of likely attacks on internet voting systems, any one of which could taint the results of an election.
First, individual voting jurisdictions are vulnerable to attack. (In the U.S., for federal elections, that essentially means counties, totaling more than 7000.) Even in local races, there can be billions of dollars at stake in high-population counties like Cook County or L.A. County. Vendors, both their networks and their source code, are also at risk. Assuming that even best efforts can keep the source code behind the handful of election-system vendors safe is a sucker's bet, Jefferson says. Even large companies with enormous security resources have been hacked, with source code a prime target, as happened to Google and 25 other firms in 2010 in a breach attributed to Chinese operatives. "Who knows if those [online voting software] vendors have already been penetrated? You wouldn't have any idea," said Jefferson.
Even if both local voting authorities and e-voting software vendors were themselves able to deflect all attacks, voters using an online voting system on their home or office PCs would still be at the mercy of the weakest link of the chain — the security of the machines available to them. Targeted malware could be used to present a different set of on-screen options to a voter than it actually sends back to the election counters. Because one of the protections of a secret ballot is to make available to voters proof that they voted but not how they voted, individuals who intended to selected candidate A would have no reason to know their vote was cast for candidate B instead. Malware could also simply vote without user interaction. It may not be election related, but a large fraction of PCs are already infected with some kind of malware, showing how big a problem this could be.
Finally, pure network attacks (or even errors) could disrupt the integrity of an election; exactly that kind of attack brought much of Estonia's online traffic to a halt in May 2007; lucky for Estonians that was not during an election, because Estonia is one of the few countries that has fully adopted online voting. Perhaps more chilling is the brief re-routing in April 2010 of 15 percent of the world's internet traffic through China.
Insecurity on the internet is itself a long-standing problem, so why the fuss? Unlike financial crime, such as credit card fraud, election fraud is hard to detect, and even harder to correct for, in large part because ballot secrecy is key to fair elections.
Voting is different. "Superficially, you'd think the transactions are very similar [to financial transactions], but underneath, all the issues are completely different. The privacy requirements are completely different, for example," says Jefferson. To prevent coerced voting, or simple vote selling, "You're allowed to tell anyone how you voted all you want, but you're not allowed to have proof of how you voted." Rolling back results to investigate suspected breaches is impossible, Jefferson says, without exposing the actual votes of individuals, at the very least to election officials.
Investigating financial crime online is the opposite; there, figuring out exactly who did what and when is the whole point, and the evidence is easy to find: if banking credentials are stolen, he said, "some account will go to zero." But in the case of elections, it's more likely that "the wrong people take office, and life goes on, and it's just never discovered."
And while no election fraud has yet been attributed to it, the trend is growing to institute the version of online voting that Jefferson calls "the worst idea ever" — voting by email. 33 states have modded their voting systems to accept in some cases PDFs of scanned ballots through ordinary e-mail to be entered by election workers. The numbers may be small (typically, this form of voting is limited to overseas voters, and in some cases voters are asked to acknowledge that their vote cannot be kept secret), but this allowance means that "e-mail voting is very widespread in the United States."
While Jefferson works through Verified Voting to influence policy makers to lay out the case against online voting, J. Alex Halderman, in his role as an assistant professor at the University of Michigan, turns theory into reality: he and his students break election systems (devices as well as software) in the U.S. and abroad to show just how easily a malicious attacker could do the same. He offered as an example of several of the ways electronic voting can fail his successful attack on an internet voting plan (see this earlier Slashdot story) that was to have been implemented in 2010 in the District of Columbia. The District had, with Federal grant money, designed an online voting system and already put it nearly into production, and had mailed PINs and voter ID numbers to voters in anticipation.
To D.C.'s credit, Halderman says, the election officials at least asked first for advice from security experts around the country, and invited them to test it in advance of using the system in an actual election, though mere days before the system was to have gone live. "It's not every day you're invited to hack into government computers without the threat of jail hanging over your head," says Halderman, who was attracted to the challenge of investigating the system itself, as well as curiosity about how the D.C. officials would respond to a system compromise.
Though Halderman says the Ruby on Rails-based system was written in "generally clean code," his team discovered a shell injection vulnerability which gave them access to the D.C. system (see his full paper as a PDF for the details), and immediately set about playing.
Web apps tend to be brittle, says Halderman, and D.C.'s was no exception. "App frameworks are written in ways that allow small mistakes to have big consequences," especially when vulnerabilities are often widely disseminated soon after discovery, and not always by white hat hackers like him.
"The first thing we did was steal all the important stuff," he says — credentials, keys, and more. Simply snooping on the data wasn't enough to fully demonstrate the problems in the system, though; the team replaced the information on all of the ballots as well, replacing the actual candidates with ones of their choice, offering up options like Hall 9000, and Bender for school board, and forced client machines to play the University of Michigan's fight song, before erasing the logs that would have allowed their intrusion to be properly analyzed by the system's administrators.
Their attack also led them to gain full access to a terminal server on the same network, and after they'd hacked into this ("using the default password from the owner's manual," Halderman notes) they noticed there was evidence in the logs of other attacks. In particular, some of the attacks appearing to originate in Iran and in China. While Halderman doubts these represent an attack specifically on the DC system voting system, the evidence of such attacks is "an illustration of how vulnerable things are."
Halderman acknowledges that voting in person, especially by electronic means, is far from foolproof, but he joins Jefferson in saying that online voting is categorically worse, and suggests that everyone who takes an interest in security or the mechanics of democratic elections raise the issues of privacy and security. His conclusion and advice for election officials in the U.S.: Voting online is a bad idea, and it simply can't be fixed in the foreseeable future. All the security problems of e-voting machines at polling stations apply directly to internet voting, too, which means that anyone on Earth can attack an online election.
"If my vote is insecure, everyone else who lives under that same government is harmed by that."
Anonymity vs. Accountability (Score:5, Insightful)
About the only way to do that is to issue each person to have a pass-phrase coupled pair of electronic "vote cards" that is non-identifying. It would require the present of both cards and the pass-phrase to vote. If you lost one card, you can use the other (plus the pass phrase) to invalidate the lost card (and any recently casted votes.) If you lost both cards, you are SOL. No vote for you.
So, you just can't have a reliable electronic voting system.
Ease of access is not a problem in the US (Score:5, Insightful)
Over the last few decades, American states have tried one thing after another to "make voting easier" in an attempt to increase participation (and, usually, to sway elections by increasing the number of voters aligned with one major party or the other). Two of the most significant have been the passage of "motor voter" laws (you can register to vote when you get or renew your driver's license) and "vote by mail". However none of these have really worked. People (like me) who are inclined to vote will do so, whether by mail or by traveling to an assigned polling place. The majority of American voters, though, simply don't seem engaged in the process.
I'd be all for e-voting with the right technology (secure and economical), but it's just about convenience for me. But I'll vote in any case - I have no illusions it'd increase participation.
I have a better attack (Score:3, Insightful)
1. Identify areas where [opposing party] voters are likely to outnumber [supported party] voters.
2. DDoS routers / MITM block voting site for those areas.
3. Power.
No, I didn't miss a step.
Re:Anonymity vs. Accountability (Score:5, Insightful)
To further comment, I don't think the biggest problem with online voting is going to fraud, it's going to be incompetence.
Idiots now can't find their precincts, get confused over which box to check, etc. Put them in front of a computer and it's a recipe for lawsuits and protests.
Re:The problem is not with online voting (Score:5, Insightful)
No, the problem (among many, many others, though I think this is the biggest) is that there's no way to provide a secret, anonymous ballot. With online voting, parties could reward those voting for them, or bosses could require that their employees vote for the "company party". Verification of a user's vote is as easy as making them log in and vote in your presence, on your computer. Hell, a company could just require that you hand over your login and vote for you. Outside of physical presence, how do you suggest these problems be worked around?
Re:Anonymity vs. Accountability (Score:3, Insightful)
I would add:
1. Register in a timely manner. Same day crap is asking for fraud.
2. Get a photo ID.
But I guess all that is racist somehow.
Many of you missed a main point. (Score:4, Insightful)
2.) The problem is not stopping cheating, but detecting it.
3) Which clearly illustrates the problem with using internet voting.
The most interesting thing about internet/computer technology is the huge decrease in the number of humans necessary to do work. An executive with good words skills doesn't need a secretary pool.
Similarly the real problem with the internet/computer based voting is that now a small group of hackers can cause MAJOR election fraud with a far fewer number of conspirators. The traces are much harder to find, or worse, to prove.
It is not the ease of cheating that is the problem, but instead the difficulty of detecting it.
Re:Anonymity vs. Accountability (Score:5, Insightful)
If people can't put out the effort to register on their own or get to a voting booth, how likely are they to put out the effort to learn about the candidates and issues, and make an informed choice? Making it easier for idiots to vote is a _bad_ thing.
Everyone Must Understand the Voting Process (Score:5, Insightful)
In my view an important property of any ballot is that the great majority of people must be able to understand the whole process. That's the only way for people to have confidence that there's a reasonable chance of detecting and preventing rigging. It also rules out pretty well any form of electronic voting. Internet security involves very serious maths that very few people can handle.
Around here we still write numbers in squares on pieces of paper and drop them in the ballot box. It works. The cost is tiny compared to the cost of government. I just can't see the advantages of more automation being worth the risk.
People might think it weird that an IT guy would have this luddite view but I think, on the contrary, I'm better placed than most to know what could go wrong.
Re:Privacy vs. Accountabilty (Score:5, Insightful)
Privacy is a huge issue here. Now if you have to go to a voting booth to vote your overbearing SO can't coerce you to vote one way or another. You have plausible deniability. That's kind of hard to do when they're standing behind you watching you vote from the family PC.
Re:It would be better than Canadian election fraud (Score:2, Insightful)
You fundamentally misunderstand the issues.
> The difficulties of coding a secure voting system are no more difficult than those of coding a secure debit or credit card payment transaction, and subject to EXACTLY the same risks.
No... individual financial transactions can be verified by both parties after the fact (on your transaction record). Individual voting results cannot be verified by either [to prevent coercion, vote-selling, and reprisals]. Instead, aggregate voting results must be verifiable without tying them to an individual voter. It is a completely different problem.
> The bigger issue is that every single electronic voting platform I've heard of to date has been a closed-source solution, uninspected, unverified, and unaudited. With a proper open source solution that could be inspected and vetted by the hundreds of thousands of programmers out there who'd be interested in finding flaws, I've no doubt a proper solution could be implemented.
Open source platforms are meaningless in voting because you cannot prove that the machine is running the software that you that claim it is. Vet the software all that you want. It doesnt prevent a vendor from silently installing a different version into a virtual machine.
Re:Anonymity vs. Accountability (Score:3, Insightful)
If you're too fucking lazy to vote in person, fuck you, no one gives a rats fuck what you think anyways.
If you're too fucking stupid to realize that there are a million and one legitimate reasons why voting in person may be difficult to impossible for a lot of people who have every bit as much of a right to vote as anyone else, fuck you, you're not fucking worthy to vote.
Re:Vote by Mail works very well in Oregon (Score:4, Insightful)
Vote-by-mail is a secure, effective, and practical voting method, and is virtually immune to the sorts of systemic fraud that plague electronic voting.
Wrong. It's vulnerable to systemic fraud in the counting. If you infiltrate the post office or the election office you can easily alter the results in volume.
When you have a polling location you can verify the box is empty, observe people placing votes into it, and observe the counting. You observe every step in the process to get your poll's final tally, and when the results are posted with a breakdown by polling location you can verify that it was added correctly to the total. All you need is a few trusted people per polling location and you can trust the results.
But in vote-by-mail the only part you observe is casting your own vote. You can't say that a 'household tyrant' didn't vote for others -or- that systemic fraud didn't occur in the post or in the tally. It's better than internet voting could ever be since the unobservable parts (post office, elections office) are harder to corrupt and get away with it, but it's still unacceptable for running fair elections.
Re:Anonymity vs. Accountability (Score:4, Insightful)
I waffle on this issue more than Mitt Romney waffles on, well, every issue ever.
On the one hand, I understand completely: If the candidates I want to win end up losing, I want to know it was because the other voters made informed choices and disagreed with me. Not because they were hoodwinked, not because they saw what letter was next to the guy's name and knew everything they needed to know, not because they think candidates stand for things they don't actually stand for, not because they think their choice has nice hair or teeth or the right or wrong religion.
But on the other hand, the "idiots"--and that's an awfully loaded term--are going to be represented by these very same people. That's why they were able to vote differently from me. Don't they deserve the same voice in the process even if they choose to be wholly uninformed and vote party or anti-incumbent or whatever they do? Don't "idiots" need representation as much as I do, quite possibly more?
Not to mention the fact that while there are plenty of thoroughly uninformed white people, those more likely to be uniformed are going to tend to be minorities who don't have the same access to information as the average Slashdotter does. Yeah, they could go to the library (if they know how to use a computer) -- but look at how many people don't vote because it's not convenient enough. The idea of spending hours at the library before that is going to be a non-starter for even more significant numbers of people. It's also significantly easier for a white-collar worker to find time to vote than a blue-collar worker.
It's tough. I certainly want informed voters, but does that mean that encouraging uninformed voters to vote is a bad idea? Ehhh...
Re:Anonymity vs. Accountability (Score:5, Insightful)
You could take away many of those reasons by holding elections on a sunday, like pretty much every other country. I still don't understand how people need to take time off from work to go voting in the US. No wonder only old people vote, they've got time to do this.
Worst thing possible. (Score:4, Insightful)
There's a running joke with World of Warcraft accounts, where a reasonably sophisticated group of mostly Chinese hackers constantly tries to log in as you. There's been phishing emails (please fill out this survey / you've won a free in-game whatever / your account is in danger of being disabled if you don't confirm you are you), there's phishing whispers in game (player to player direct communication), there's phishing shouts in trade chat (a channel visible to a very large percent of a server at any given time). They post bogus links on forums. Once you follow a link, it's all about exploiting your browser or just fooling you to typing stuff in. You can have an 'authenticator', one of those pseudo-random d00ders that gives you a number, so that stops you from being vulnerable to direct keylogging, unless there is an active agent waiting for that very moment (which has ALSO happened).
This is for WOW GOLD. Imagine what it will be like if it is for THE FATE OF NATIONS.
In addition to all the crap listed above, the amount of manipulation a logged in hacker has to do to gain anything out of your WoW account is actually substantial. It is not substantial to have a tiny thing listed that changes your vote from Bob to Alice, while still telling you that you voted for Bob. Whatever you add to work around this is also trivial to get around for your hacker. Do you send a confirmation email? He sends a fake one, after redirecting yours. Whatever you come up with, there's a a way around it, because YOUR CLIENT IS HACKED and THAT WILL HAPPEN. WoW players are at least reasonably nerdy, but in my guild I've seen a masters in EE get hacked (he trusted a binary, don't say you never have), and I've seen a very consistently clever man with get hacked (he doesn't know how exactly, but it's probably when he accessed from a hotel or something). Let me be brief: the dumbest American gets a damned vote, and it is HIS RIGHT that it get cast correctly, and he- or his army of other mouth breathers that access his machine, such as his also dumb wife and kids, will definitely click on whatever rabbit with the pancakes to ensure his machine is thoroughly 0wzzrd months ahead of time, and he'll think he voted for Bob, and he'll cast a vote for Alice, and then democracy breaks even more than it already is.
If they give you online voting, your vote is literally meaningless.
And this is before all the voter fraud that gets EASIER but happens already.
And this isn't the Demopublicans or the Republicrats ensuring their tool gets in office, this could be foreign interests taking over.
Online voting is the worst thing for Democracy, worse even than a dictator covered in blood with heads on spikes.
Re:Anonymity vs. Accountability (Score:5, Insightful)
Re:Are you kidding me? (Score:4, Insightful)
Because.. you don't get a different answer every time?
Pretty much, yeah. Specifically, if you got a wrong vote count the first time, you will get the same (still wrong) vote count the next time.
Suppose you go to an ATM to check your account balance, and it says you have a thousand bucks less in your account than your financial records say you should, so you go to the bank and ask them to check your account for any unauthorized transactions. Now suppose the teller just pulls up your account on screen, glances at the account balance, and says, "Looks like the ATM's right." Would you consider that a satisfactory resolution to the problem?
There is one reason that cannot be fixed (Score:4, Insightful)
Let's assume we create the perfect, impossible to hack and manipulate voting machine, completely open, auditable and whatnot to address all those issues. Still one thing remains: It requires special skill to audit the process.
Today, it's fairly easy to debunk someone calling fraud. Here's the paper ballots, count your heart out. Count again and again, it takes a fairly low skill level to do that. You need to be able to identify the intent of the voter (i.e. play "where is the X") and you need to be able to count. Even reading and writing is not a required skill. I'm fairly confident the average 3 year old could accomplish that feat, at least to some degree. And if all he does is make ticks and then compare the amount of ticks made.
To audit a voting machine, you need a fairly specialized and quite high level of skill. This cannot be done by your average 3 year old, hell, it cannot be done by the average adult. A tiny, insignificant portion of the population is able to do that. You'd have to trust those people if they say that the voting machine isn't cheating.
But why should you?
I fear a loss of trust in the democratic process. Even ignoring conspiracy theories where all the security experts are out to bring down humanity by collectively manipulating the machines and keeping it under wraps, it is not possible anymore to eliminate without a doubt any allegations of rigging elections.